Cisa Known Exploited Vulns Scraper

CISA Known Exploited Vulns Scraper

This CISA known exploited vulns scraper reads the public catalog and writes one row per CVE. You do not need an account or proxy configuration to get started. Choose between the full catalog or a local filter, set your item cap, and export your dataset as JSON, CSV, or Excel from Apify.

This actor pulls from the official public feed and organizes vulnerability tracking cleanly for security teams, patch management, and research workflows.

Use cases

• Patch queues: Pull newly cataloged CVEs and sort them quickly by due date.
• Vendor watch: Keep tabs on Microsoft, Apache, or any other vendor without manually downloading large files.
• Ransomware triage: Filter specifically for rows marked as associated with known ransomware campaign use.
• Keyword search: Find specific product names or bug classes inside vulnerability titles and descriptions.
• Scheduled export: Automatically drop the dataset into your preferred storage or alerting pipeline when the catalog updates.

What data does this actor extract?

The actor operates in two modes within a single request:

• full_catalog: Downloads the feed once and emits every vulnerability up to your specified item cap.
• filter: Uses the same underlying file and keeps only the rows matching your selected vendor, keyword, date added threshold, and ransomware criteria.

The feed is structured as a single document with no page or offset parameters. The actor handles delays, retries on temporary hiccups, and gracefully handles any network interruptions, returning a clean error record instead of crashing the run if something fails.

Input

Parameter	Type	Default	Description
mode	string	full_catalog	Choose between pulling the full catalog or applying local filters.
vendors	array	["Microsoft"]	Vendor or project names for filter mode (case-insensitive match).
keyword	string	""	Substring search on vulnerability name and short description.
addedSince	string	""	Keep records added on or after YYYY-MM-DD.
ransomwareOnly	boolean	false	Keep entries flagged for known ransomware campaign use.
maxItems	integer	100	Maximum vulnerability rows to save (between 1 and 1000).
requestDelaySecs	number	1	Pause before making the catalog request.
timeoutSecs	integer	300	Stop the run after this many seconds (max 3600).
requestTimeoutSecs	integer	30	Per-request timeout limit.
proxyConfiguration	object	useApifyProxy: false	Optional proxy settings. Leave off unless needed.

Example input

{
  "mode": "filter",
  "vendors": ["Microsoft"],
  "keyword": "spoofing",
  "addedSince": "2026-01-01",
  "ransomwareOnly": false,
  "maxItems": 100,
  "requestDelaySecs": 1,
  "timeoutSecs": 300,
  "requestTimeoutSecs": 30,
  "proxyConfiguration": { "useApifyProxy": false }
}

Output

Results are pushed directly to the default dataset. A standard vulnerability record looks like this:

{
  "cveID": "CVE-2015-5477",
  "vendorProject": "ISC",
  "product": "BIND",
  "vulnerabilityName": " ISC BIND Data Processing Errors Vulnerability",
  "dateAdded": "2026-10-08",
  "shortDescription": "ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.",
  "requiredAction": "Apply mitigations per vendor instructions.",
  "dueDate": "2026-10-11",
  "knownRansomwareCampaignUse": "Unknown",
  "cwes": ["CWE-19"],
  "notes": "[https://www.cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)",
  "source_url": "[https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)",
  "scraped_at": "2026-10-12T00:00:00Z"
}

Pricing

This actor is free to run on Apify outside of standard platform usage.

FAQ

• Can I export CSV or Excel? Yes, Apify natively supports exporting datasets as JSON, CSV, or Excel.
• What happens if a request fails? You will receive a structured error row containing the status and message rather than an abrupt run failure.
• How many CVEs can one run save? The maxItems parameter defaults to 100 and can be adjusted up to 1000.

Is web scraping legal?

Collecting publicly available catalog data is generally permissible. This actor operates strictly on public data without attempting to bypass access controls or authentication mechanisms. Note: This is not formal legal advice. For more details, see Apify's guide on web scraping legality.